PentestAgent – AI Penetration Testing Tool With Prebuilt Attack Playbooks and HexStrike Integration
PentestAgent, an open-source AI agent framework developed by Masic (GH05TCREW), has unveiled new features, including prebuilt attack playbooks and HexStrike integration.
PentestAgent, an open-source AI agent framework developed by Masic (GH05TCREW), has unveiled new features, including prebuilt attack playbooks and HexStrike integration.
This tool, released on GitHub, utilizes large language models (LLMs) such as Claude Sonnet or GPT-5 via LiteLLM to perform advanced black-box security assessments.
Operating through a terminal user interface (TUI), PentestAgent offers modes for assisted chats, autonomous agents, and multi-agent crews, providing pentesters with AI support while maintaining control. It is essential to ensure legal compliance by testing only authorized systems, as unauthorized access is unlawful.
PentestAgent includes structured attack playbooks with predefined workflows for web app testing similar to THP3-style assessments. Users can initiate them using the following command:
pentestagent run -t example.com --playbook thp3_web
These playbooks guide the AI through reconnaissance, vulnerability scanning, and exploitation phases, incorporating domain-specific knowledge from a Retrieval-Augmented Generation (RAG) system.
Session notes categorized as credentials, vulnerabilities, findings, or artifacts are stored in loot/notes.json , supporting a "shadow graph" in Crew mode, where an orchestrator deploys specialized workers for strategic insights.
The tool supports three operational modes:
It is essential to ensure legal compliance by testing only authorized systems, as unauthorized access is unlawful.
Mode Command Description
Assist (default) Interactive chat; user directs flow.
Agent /agent <task> Autonomous single-task execution.
Crew /crew <task> Multi-agent orchestration.
Built-in tools include a terminal (for nmap , sqlmap), a browser (via Playwright), notes, and web_search (Tavily API required). TUI commands like /target <host> , /tools , /report , and Esc-to-stop offer intuitive control, with memory usage visible via /memory .
Setup is straightforward for Python 3.10+ environments. Clone the repository:
git clone https://github.com/GH05TCREW/pentestagent.git
Configure .env with an API key (e.g., ANTHROPIC_API_KEY=sk-ant-... and PENTESTAGENT_MODEL=claude-sonnet-4-20250514 ). Install Chromium via:
For Docker isolation, pull pre-built images like:
docker run -it --rm -e ANTHROPIC_API_KEY=your-key ghcr.io/gh05tcrew/pentestagent:kali
A significant update is the HexStrike integration, available in third_party/hexstrike from GitHub . This MCP (Model Context Protocol) framework provides advanced pentesting tools through mcp_servers.json . Install manually via:
pentestagent mcp add nmap "npx" "-y" "gc-nmap-mcp"
CLI management commands such as pentestagent tools list and mcp test ensure extensibility. Recent TUI updates enhance stability for long-running tasks.
Based on reporting by Cyber Security News.